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We demonstrate that secure quantum key distribution systems based on continuous variables imple- 
mentations can operate beyond the apparent 3 dB loss limit that is implied by the beam splitting 
attack . The loss limit was established for standard minimum uncertainty states such as coherent 
states. We show that by an appropriate postselection mechanism we can enter a region where Eve's 
knowledge on Alice's key falls behind the information shared between Alice and Bob even in the 
presence of substantial losses. 



The distribution of random keys for cryptographic pur- 
poses can be made secure by using the fundamental prop- 
erties of quantum systems such that any interception of 
the key information can be detected. This was first dis- 
cussed for discrete systems jjj and experimental demon- 
strations have been carried out using optical sources, 
which produce low photon number states More re- 
cently schemes based on continuous quantum variables 
have been proposed where the scheme by Gottes- 

man and Preskill jij] has been proven to be information- 
theoretically secure. Apart from being of fundamen- 
tal interest these schemes offer certain practical advan- 
tages. However, they all share one major disadvantage: 
currently it is thought that the use of continuous vari- 
able techniques does not allow quantum key distribution 
(QKD) beyond 50 % loss @|. This severely limits the 
applicability of such schemes. 

The argument leading to this limit is based on an 
optimal cloning approach for optical signals that cor- 
responds to a beam splitting attack on the signals [Q. 
At the loss limit an eavesdropper Eve can replace the 
lossy channel by a perfect one with an adapted beam 
splitter to mimic the losses. She can then generate a 
cloned signal with a fidelity which depends on the beam 
splitter transmission. In order to extract a secure key 
out of the material with the usual privacy amplification 
tools § and a free choice of the required error correc- 
tion technique, including the efficient two-way schemes 
however, the mutual information Iab between Al- 
ice and Bob has to exceed the information that either 
of them shares with Eve: Iab > ^^{IaEtIeb}- This 
condition arises as follows: In order to perform privacy 
amplification || one needs to be able to estimate Eve's 
information on the data shared by Alice and Bob after 
error correction. Two-way error correction provides ad- 
ditional information to Eve in two forms: redundant in- 
formation to enable error correction, that are according 
to Shannon's theorem at least 1 — Iab bits, and informa- 
tion about the positions of bits where Alice's and Bob's 
data initially differ. In the worst case, the two-way error 
correction scheme leaks the complete information about 



these error positions to Eve, so that Eve's information 
about Alice's and Bob's key now stands on the same 
footing and satisfies I[ab)e — max {^A_E, Ieb}- In the 
protocol presented below, we actually find equality, as ex- 
plained later. Taking this into account, the usual mech- 
anism of one-way communication schemes applies, and 
we find for individual attacks via ||,[lo] |l2| the condition 
Iab > max{lAE, Ieb}^ Yet, for losses beyond 50%, one 
finds that the condition Iab > Iae is violated so that 
the above standard methods cannot be used without ad- 
vanced quantum technologies such as quantum memories 
and entanglement purification which are presently not 
available. Note that one may to restrict the information 
flow for error correction from Bob to Alice or vice versa. 
In this case the " maximum" in the above case may safely 
replaced by the "minimum" p0| , ^3[ , but efficient proto- 
cols for one way error correction close to the Shannon 
limit for typical error rates around 5% are still missing 
up to now. 

In this paper we propose a novel scheme, which oper- 
ates beyond the apparent 3 dB limit that is applied by 
the beam splitting attack. In certain situations it is still 
possible to create a secure key || although Iab < Iae 
or even Iab < I be- For classical correlations the proce- 
dure is known as advantage distillation [pd]| ; upon closer 
investigation this turns out to be a form of postselection 
and requires two-way classical communication. Gottes- 
man and Lo used this technique to increase the tol- 
erance against errors in the single-photon BB84 protocol. 
Postselection is a standard intrinsic procedure in conven- 
tional QKD with weak pulses: if no photon is detected 
by Bob, or when Alice and Bob did not measure in the 
same basis, the corresponding time slot is ignored and 
hence does not contribute to the raw data. Without this 



'Following discussions with P. Grangier, it should be pointed 
out that specific two-way error correction techniques might 
leak less information about error positions leading to less de- 
manding conditions. 
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postselection the condition Iab > nmx{lAE, Ieb} could 
never be reached for any QKD protocol for losses be- 
yond 3 dB, because then Eve has access to better signals 
than Bob. However, postselection allows unconditionally 
secure key exchange in presence of large losses, limited 
basically only by the photo-detection process |l5j ]. The 
situation becomes more subtle for continuous variable 
schemes, since then always a non- vacuum signal reaches 
Bob and correlations appear between the data measured 
by Bob and that of an potential eavesdroppers via Alice's 
state preparation. Thus the postselection has to be made 
more conscious, and here we show how to do this. The 
selection of favorable data for Alice and Bob has been 
previously addressed in the context of implementing the 
BB84 protocol with weak coherent pulses in the presence 
of a strong phase reference pulse jl6| . Our results demon- 
strate that continuous variables and weak coherent pulse 
schemes are closely linked in the basic principles. 

We consider the following scheme, which is similar to 
those proposed by Cerf et al. || and Grosshans et al. . 
Alice sends an ensemble of coherent states to Bob with 
a Gaussian distribution of complex amplitudes centered 
on the vacuum. Bob measures either of two conjugate 
quadratures, say for example the in- and out-of phase 
quadratures X and Y, using homodyne detection. The 
measurement results x are then given as eigenvalues of 
quadrature operator x\ — i(ae~ lA + aV iA ) with A = 0, 
or ^. Bob will effectively see a Gaussian distribution 
of real amplitude coherent states when he looks at the 
quadrature X and a Gaussian distribution of imaginary 
amplitude coherent states when he looks at the quadra- 
ture Y. Bob reveals which quadrature he measured in 
each time interval and estimates whether Alice prepared 
a coherent state with a positive or negative displacement 
in the corresponding quadrature. Alice and Bob can now 
interpret positive displacements as logical "0" and nega- 
tive ones as logical " 1" . 

For our analysis of the security of this scheme we ex- 
tend this protocol and specify the used states by addi- 
tional steps. After Bob's publication of his choice of the 
quadrature, Alice will interpret the state she sent either 
as a member of the set {| - a e-' l9 ),\a e te )} 7 if Bob 
detected the quadrature X. or {j — ia e~ ),\ia e )} 
(a e M), if Bob measured the quadrature Y. She now 
publishes the values of a and 9. In each case, from 
Bob's and Eve's perspective, this narrows down the num- 
ber of possible signals to two, for example \a e %e ) or 
| — a e~ t6 ). Thus Alice and Bob can build up a secret 
key as before when now the encoding reads more specif- 
ically: \a e w ) -> "0", | - a e~ lB ) -> "1" for amplitude 
measurements and \ia e 10 ) — > "0", | — ia e~~ l6 ) — > "1" 
for phase measurements. Other choices of signal sets are 
possible, for example sets with point symmetry, but the 
choice above turns out to be favorable. 

To investigate the secrecy of the key the distribution 
of Bob's data conditioned on the choice of Alice can be 



accessed using classical communication. For this purpose 
Alice and Bob open up complete signal descriptions and 
measurement results for some randomly chosen transmis- 
sion events. Thus the statistics of Bob's detected results 
should mirror Alice's coherent state preparation with ex- 
pected Gaussian distributions centered according to the 
complex amplitude displacements. 

Eve's first strategy is thus passive intervention via the 
beamsplitter attack JtJ. Eve's intervention is indistin- 
guishable from loss. In the typical loss model Alice's 
state is transformed as 

\ae w ) B \0) E ^\^jae^) B \^T^ v a e* e ) E (1) 

for arbitrary a and 9, where r\ is the transmission effi- 
ciency between Alice and Bob. Alice and Bob are none 
the wiser but Eve ends up with all the lost signal. It 
was shown 0, that provided the loss is less than 50% it 
is still possible for Alice and Bob to distill a secure key 
when faced with such an attack. We will now show that 
in fact 50 % loss is not an ultimate limit for secure QKD. 

We wish to find a way by which Alice and Bob can 
postselect a subset of the data for which they have a 
high mutual information, but for which Eve and Alice 
do not. Alice and Bob can base their selection proce- 
dure on the parameter a and 9 characterizing the state 
preparation and Bob's measurement results x or y. The 
overall mutual information of Alice and Bob can then be 
subdivided into different effective information channels 
characterized by the parameters (a, 6, x), such that 

Iab = / dx da d9 p(a,9,x) ■ lAB{oi,8,x). 

J a ,e,x ( 2 ) 

Similarly the overall information Alice shares with Eve 
can be composed from all single events. 

Note, that the separable nature of the state of Eq. (|l|) 
ensures that there is no correlation between Bob's and 
Eve's quantum uncertainties. Thus Eve's mutual infor- 
mation with Alice does not depend on Bob's detected 
outcome x. Furthermore, Eve shares with Bob always 
less information than with Alice, I be < Iaej and it is 
sufficient to consider Alice and Eve's information only. 
Altogether, this allows us to evaluate the knowledge 
of the different parties separately for all effective in- 
formation channels and we can restrict our analysis to 
find suitable parameters (a, 6, x) with Iab{oc,9,x) > 
Iae(<x,9). Since the beam splitting attack and proto- 
col itself are symmetrical in respect to the considered 
conjugate quadratures, it is also sufficient to investigate 
only the case of a quadrature measurement X by Bob. 

To identify the good effective channels, we calculate 
the mutual information shared by Alice and Eve. Al- 
ice sends a priori pure states. However knowing noth- 
ing about Alice's state preparation Eve would have to 
distinguish between two allowed mixed states character- 
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ized by positive or negative displacements in the respec- 
tive quadrature. So far no general expression for the ac- 
cessible information is known for non-orthogonal mixed 
states. For this reason we provide Eve with the addi- 
tional information about a and 9. As a trade-off Eve 
has to distinguish for each effective channel between two 
non-orthogonal pure states, in the case of X quadrature 
measurements between \a e t0 ) and | — a e~ ld ). In this 
situation the maximum accessible information is known. 
It is given as a function of the overlap / of the respective 
two states jlTj in the form 

Iae{ol,0) = 



-(1 + log(l + y/l-f 2 (a,0)) + 



+-(1 -y/1- p(a, 6)) log(l - Vl - / 2 («, 6)). (3) 

For an effective channel with parameters a and 9 the 
overlap can be calculated as 

f(a,9) = (- a ^T^,e- ie \a VT=7,e ie ) = e -^> E \ 

where we defined as E = acos(O). The protocol ensures 
that the overlap and thus the mutual information of Eve 
depends only on the effective amplitude E = acos(0). 
As we will see later, the parameters a and 9 enter the 
mutual information of Alice and Bob always in the same 
combination. This allows us to consider in the following 
the parameters (E, x) only. 

At this point we note that the states between which 
Eve has to distinguish and their a-priori probabilities 
do not change if we give Eve the additional information 
whether Alice's and Bob's decoded bit differs for a given 
signal. This kind of information is leaked in two-way er- 
ror correction (see above). It is for this reason that we can 
assume equality in the bound I'/^ B \ E > maxf/iB, Ieb} 
of Eve's information I'r^ B ^ E on Alice's and Bob's key 
given the knowledge of all error positions. 

Next, we calculate the mutual information of Alice and 
Bob. According to the protocol Bob performs quadrature 
measurements and decodes the bit value as the sign of the 
detected displacement. Depending on the signal states 
| ±a e }, his outcomes x are distributed corresponding 
to one of the probability distributions 

P(x\ | ± a e ±w }) = \(x \ ± a e ±w }\ 2 = </V 2 (^ E ^ 

V7r (4) 

with \xq) as the eigenstate of the quadrature operators 
with A = 0. This decoding leads to an error rate 
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FIG. 1. Illustration of the error rate of Bob's decoding 
scheme, here for a loss of 50% and an effective amplitude 
E = acos(9) = 1. Left: probability distributions of Bob for 
prepared bits "0" and "1"; Right: probability that Alice has 
encoded "0" or "1", if Bob obtained a result x. 

To illustrate Bob's decoding we consider in Fig. 1 the 
case of 50% loss and an effective amplitude of E = 1. 
The left graph depicts the two possible distributions for 
Bob's results x corresponding to Alice's states \a e t6 ) and 
| — a e~ %e ). For the intersection point at x — 0, Bob's 
measurement delivers no information, but for all other 
values of x, the distribution corresponding to Alice's en- 
coded bit value is more probable. In the right graphs we 
plotted the probability that Alice has encoded a "0" or 
" 1" , if Bob actually obtained the value x. With the ar- 
ranged bit assignment the smaller value of these graphs 
gives Bob's error probability corresponding to Eq. (|^). 
Alice's and Bob's mutual information can now be cal- 
culated separately for all effective information channels 
with (x, E) by the Shannon formula. 

I AB (x,E) = l+p e \og 2 p e + (1 -p e )log 2 (l -p e ) . (6) 





for x < (5) 
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FIG. 2. Comparison of the mutual information between 
Alice and Bob and the information they share with Eve 
for different state preparations with effective amplitude 
E — cos(a) and measured outcomes x of Bob. Positive ar- 
eas, colored bright, indicate effective information channels 
that contribute to secure key exchange since they satisfy 
Iab(x,E) > I A e{x,E). 
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We are now in a position to identify those effective in- 
formation channels with Iab(x,E) > Iae(x, E), which 
allow to extract a secret key. Fig. 2 displays the differ- 
ences of the respective information plotted for the events 
(E, x) again in the case of 50% loss. Positive valued ar- 
eas, indicating region of possible secure key exchange, are 
colored bright, negative ones in dark. Thus our investiga- 
tion allows us to model an ideal postselection procedure, 
where all events (x,E) with Iab > rnax-f/yis, Ieb} ac- 
tually contribute to the key. 

The comparison of Fig. 2 between the mutual infor- 
mation of Alice and Bob and the information they share 
with Eve dplays an insight, that was first recognized in 
fusf . Alice and Bob can actually utilize statistical mea- 
surement results with large x to increase their security, 
but Eve, on the other hand, cannot improve her error rate 
for Bob's selected data. This is, because her state is un- 
correlated to Bob's results x. Furthermore there exist for 
each transmission 77 an optimum effective displacements 
E , such that the mutual information between Alice and 
Bob is maximized. 

We can evaluate the key rates Rk, that can be achieved 
in the presented postselection process as 

Rk = Rr x [ dxdE p{x, E) ■ [I AB (x, E) - I AE (x, E)], (7) 

where R r is the raw data rate, and S denotes the subset 
of selected effective channels. For the presented protocol 
the probability p(x, E) that the effective channel is used 
is composed of Gaussian distribution of the effective am- 
plitude E and the distribution of x conditioned on E. 
With a distribution width d for the effective amplitudes 
we find 



require the analysis of a more general attack by Eve. 
However, it is likely that the beam splitting attack is the 
optimal attack even in this protocol utilizing postselec- 
tion. The existence of optimum effective displacements 
for the mutual information between Alice and Bob opens 
the possibility construct more elaborated protocols with 
modified probability distributions for Alice's state prepa- 
ration to achieve higher the bit rates. However, in all such 
protocols one has to be cautious to ensure that the beam 
splitting attack remains the best eavesdropping strategy. 

Our result pushes continuous variable QKD closer to 
practical applications. In addition we have also shown 
that the type of postselection protocol considered here 
can also be employed for schemes using squeezed light, 
such as in Q 
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with P(x\ \ ± a e ie )) given in Eq. (|). 

First numerical calculations, where we limited our in- 
tegration over the data set within ±4, indicate that in 
the presence of 50% loss and for an optimized parameter 
of d = 2.1, bit rates up to Rk — R r x 0.0667 are achiev- 
able. For a loss rate of 75%, we have found a key rate 
of Rk — R r x 0.0073. These calculations show that the 
high repetition rates of continuous variable technology, 
which is expected to be in the GHz region, can actually 
lead to secure key rates that are well above currently 
implemented schemes. 

We have shown that continuous variable QKD using 
coherent states in the presence of losses above 50% can 
still be implemented securely against an eavesdropper us- 
ing an individual beam splitter attack. The postselection 
process solely relies on classical data processing and thus 
does not require sophisticated quantum resources other 
than coherent states. An absolute proof of security would 
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